Privacy Policy

1. Controller

Brooklyn Soap GmbH, Kaiser-Wilhelm-Str. 83, 20355 Hamburg (“Brooklyn Soap,” “we,” “us”) operates the website and is the controller responsible under data protection law.

We respect the personal rights of visitors to the website. The following Privacy Policy describes where and for what purposes we collect and use the personal data of visitors to the website.

2. Usage Data

Every time the website is accessed, access data transmitted to us by your internet browser is automatically stored in a log file on our server. This comprises the following data:

• the previously visited page, known as the referrer URL;
• the name of the file;
• the date and time of the request;
• the amount of data transferred;
• the access status, such as file transferred or file not found;
• the web browser used;
• the operating system used; and
• the full IP address of the accessing computer.

We store this data for system security purposes, particularly to defend against attempted attacks on our web servers, on the basis of our legitimate interest in ensuring IT security pursuant to Article 6(1), sentence 1, point (f) GDPR. The IP address is deleted after no more than 30 days.

We may engage third parties to provide certain website services and the services listed below on our behalf. These third parties may, in some circumstances, have access to your data as processors. However, they generally process your data in our interests, on our behalf and only for the purposes specified in this Privacy Policy.

3. Order Processing

To prevent misuse of our services, we use a CAPTCHA tool. In particular, this allows us to ensure that a person, rather than a bot, actually wishes to use our services. Where data processing takes place in this context, it is based on Article 6(1), point (f) GDPR. Our legitimate interest is to ensure the security of our IT systems.

When you place an order with us, we process your personal data on the basis of Article 6(1), point (b) GDPR where such data is essential for processing the order, performing the contract and, where applicable, handling returns. This includes your name, email address, delivery address, billing address where applicable, and payment information. Where you have created a user account with us and participate in the Loyalty Rewards Program, as described below, we also process this information as part of the order-processing procedure.

Where you select a third-party provider such as PayPal, Payone or Klarna to process your payment, you will be redirected to the relevant provider’s website. The respective third-party provider is independently responsible under data protection law. For further information about data processing, please contact the relevant payment service provider directly.

We also disclose your contact details to shipping service providers such as DHL for the purpose of delivering the goods ordered. This data processing is based on Article 6(1), point (b) GDPR.

Where applicable, we also process your data for fraud prevention, creditworthiness checks, or the establishment, exercise or defence of legal claims on the basis of Article 6(1), point (f) GDPR, particularly where problems arise during payment processing. Our legitimate interest is the effective enforcement of, or defence against, legal claims.

We also use service providers that provide technical support for order processing and user administration as processors acting in accordance with our instructions and that receive personal data from you in this context. These include, among others, 8returns UG for processing returns and Shopify International Ltd., Ireland (“Shopify”), as the operator of our online-shop software.

The use of Shopify may also involve data transfers to Shopify Inc., a Canadian company with its registered address at 151 O’Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada. The European Commission has adopted an adequacy decision for Canada, meaning that an adequate level of data protection is ensured. Additional subcontractors used by Shopify can be accessed here.

As part of Shopify’s Content Delivery Network, or CDN, your IP address may be transferred to the relevant third-party provider; see Shopify’s subcontractors. This is done exclusively to ensure that the website functions quickly and effectively and to reduce loading times. Websites without a CDN may load very slowly in certain circumstances, which we wish to avoid in the interests of user satisfaction. Further information about Shopify’s CDN can be found here.

As part of order processing, you are required to complete the fields marked as mandatory, as otherwise we cannot enter into or perform the contract with you. However, you will not suffer any disadvantages if you do not provide optional information.

Where your data is not used for advertising purposes, we store it until the expiry of the statutory retention periods under tax and commercial law. Where your data is used for advertising purposes, we store it until you object to its use for advertising or withdraw your consent to receive our newsletter.

4. Contacting Us and Sending Emails

When you contact us, for example by email or telephone, we may store the communication and the personal data you provide in order to process your enquiry. During our business hours, we use the live-chat tool provided by Tidio Ltd. (“Tidio”) and the email software provided by Klaviyo Inc. (“Klaviyo”) and Zendesk, Inc. (“Zendesk”) to communicate with you.

We use personal data solely for the purpose you specified when submitting the data. Where it is necessary to transmit information or documents to third parties, we will first remove any personal data that is not required for the stated purpose.

Where it is necessary to communicate with third parties outside the EU in order to process your enquiry, we use appropriate organisational and technical measures to protect your data in accordance with European standards. Klaviyo and Zendesk are certified under the EU–US Data Privacy Framework, meaning that an adequacy decision of the European Commission applies to these data transfers.

For general enquiries, the legal basis is Article 6(1), sentence 1, point (f) GDPR. Where an enquiry relates to the performance of a contract to which you are a party or to steps taken at your request before entering into a contract, the applicable legal basis is Article 6(1), sentence 1, point (b) GDPR.

We delete the information from a contact enquiry when it is no longer required.

5. User Account and Loyalty Rewards Program

You may create a user account with us through which you can place orders quickly and easily. During the registration process, we process your name, email address and a password selected by you.

The legal basis for this is Article 6(1), point (b) GDPR, as a user relationship and benefits agreement is established between you and us. You may optionally add further information to the user account, particularly your address and telephone number. This data processing is based on your consent pursuant to Article 6(1), point (a) GDPR, which you may withdraw at any time, for example by deleting the relevant information.

You may also register for our Loyalty Rewards Program. This means that you can collect points for certain activities, such as subscribing to the newsletter or placing orders, and may receive benefits from us for future orders, particularly discounts, depending on your individual “Member Level.”

We inform you regularly by email of your points balance and send you the corresponding discount codes. We send these emails on the basis of our existing user relationship with you pursuant to Article 6(1), point (b) GDPR. To receive our regular newsletter in addition, you must subscribe to it separately through the newsletter registration process.

In addition to the data required for registration, we process transaction data, including loyalty points earned and redeemed, discounts, purchased items, order history and order value, in order to calculate your loyalty-points balance and Member Level and provide you with the benefits of the Loyalty Rewards Program.

Based on your individual transaction data and user profile, we create customer information and exclusive discounts that correspond to your presumed interests and purchasing behaviour. This is the main purpose of the user relationship, and the data processing is therefore based on Article 6(1), point (b) GDPR. This does not constitute automated decision-making within the meaning of Article 22 GDPR.

Where you have consented through our cookie banner to the placement of cookies and other tracking technologies, we also use this data to create and enrich your user profile. In this case, the data processing is based on your consent pursuant to Article 6(1), point (a) GDPR and section 25(1) TDDDG.

Where the terms of use of the Loyalty Rewards Program are breached, we may also process your data for fraud prevention or for the establishment, exercise or defence of legal claims on the basis of Article 6(1), point (f) GDPR. Our legitimate interest is the effective enforcement of, or defence against, legal claims.

For the operation of the Loyalty Rewards Program, we use the external service provider Yotpo Ltd., which has its principal offices in Israel and the United Kingdom and may access your data for maintenance, support and data-hosting purposes.

The European Commission has adopted adequacy decisions for Israel and the United Kingdom, meaning that an adequate level of data protection is ensured. Where data may also be accessed by other Yotpo companies from third countries outside the EEA for which no adequacy decision of the European Commission exists, EU Standard Contractual Clauses have been agreed with Yotpo to ensure an adequate level of data protection.

Yotpo also assures us that sufficient safeguards to ensure an adequate level of data protection, particularly Standard Contractual Clauses, have been agreed with the subcontractors used by Yotpo, which can be accessed here. We have contractually obliged Yotpo to comply with European data-protection requirements.

Further recipients of data are identified in the relevant sections of this Privacy Policy concerning the applicable processing activity, such as order processing, contacting us or sending newsletters.

You are not required to create a user account or to provide your data for this purpose. You may also shop in our store without creating a user account.

However, where you wish to participate in our Loyalty Rewards Program, the processing activities described above that are not based on your consent are necessary for entering into and performing the user agreement. Where you do not provide the data, you will unfortunately be unable to participate in the benefits program.

As a general rule, your data is stored for the duration of your membership in the Loyalty Rewards Program. Data subject to a statutory retention period will be deleted only after that retention period has expired.

Where data processing is based on your consent, the data will also be deleted if you withdraw your consent. In the event of legal disputes, we will retain your data until the proceedings have been concluded with final legal effect.

6. Sending Newsletters

Where you choose to subscribe to our newsletter, you must consent to the processing of personal data required for this purpose. You must provide an email address to register for the newsletter. This email address is used exclusively to send the newsletter.

The legal basis for processing the data is Article 6(1), sentence 1, point (a) GDPR. You have the right to withdraw your consent at any time, for example through the link provided in the newsletter, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. In that case, you will no longer receive the newsletter.

When you register for the newsletter, the IP address of the accessing system and the date and time of registration and email verification are also collected. This data is processed exclusively for the purpose of identifying possible misuse of an email address and documenting the consent given. The legal basis for processing the data described above is Article 6(1), sentence 1, point (f) GDPR.

We use Klaviyo and Zendesk to send and analyse newsletters. Their use allows us to analyse how recipients use the newsletters.

Among other things, it may be analysed how many recipients opened a newsletter, in which country it was opened, what type of device was used, whether desktop or mobile, which email client was used, and how often links in the newsletter were clicked.

The use of Klaviyo and Zendesk also involves transferring data to the United States as a third country. Klaviyo and Zendesk are certified under the EU–US Data Privacy Framework, meaning that an adequacy decision of the European Commission applies to these data transfers.

The processing activities described above are performed on the basis of your consent pursuant to Article 6(1), point (a) GDPR when you subscribe to the newsletter. You may withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of processing carried out on the basis of consent before its withdrawal is not affected.

In addition to the above, we send our newsletter on the basis of Article 6(1), point (f) GDPR to customers who have already purchased a product from us, meaning existing customers.

The content of this newsletter consists of information about our own products and services that are similar to the goods previously ordered, constituting direct advertising for our own similar goods. Our legitimate interest is to inform our existing customers about news and new products that may be of interest to them.

You may object to this data processing at any time, particularly by using the unsubscribe link in the footer of each newsletter. You will not incur any costs other than the transmission costs charged at the basic rates.

7. Cookies and Tracking

Our website uses technically necessary cookies that are essential for the proper operation of the website. Where personal data is processed in this context, this is done on the basis of Article 6(1), point (f) GDPR and our legitimate interest in the functionality of our website.

In particular, we use cookies to manage the consent that you can provide through our cookie banner. This ensures that cookies requiring consent are placed only after consent has been given and that the cookie banner is not displayed again. These cookies are strictly necessary for this purpose.

The legal basis is section 25(2), no. 2 TDDDG. Any associated data processing is based on our legitimate interest in proper consent management pursuant to Article 6(1), point (f) GDPR.

In addition, with your consent pursuant to section 25(1) TDDDG and Article 6(1), point (a) GDPR, we may place and use cookies to collect pseudonymous information about how visitors use our website, how they navigate through it, and the areas of the website and products in which they are interested.

This allows us to improve our website and the online experience of our visitors. It enables personalisation, usage analysis and functional features. We may also measure the success of advertisements and display interest-based advertising.

This consent may also include the transfer of data to service providers in third countries, such as the United States, with the risk that local authorities may process your data for control and surveillance purposes, including without the possibility of legal remedy, pursuant to Article 49(1), point (a) GDPR.

A more detailed description of the individual cookies can be found in our cookie consent-management system, which you can access at any time through the cookie banner or the “Privacy Settings.”

You may withdraw your cookie consent at any time, for example through the “Privacy Settings” in the footer of this website. Until consent is withdrawn, the data processing performed on the basis of that consent remains lawful.

You may also deactivate the use of cookies for audience measurement and advertising purposes through the opt-out page of the Network Advertising Initiative and additionally through the US or European website.

Where you exclude the use of cookies, you may be unable to use certain areas of the website, or may only be able to use them to a limited extent.

A detailed list of the cookies we use, their recipients and their storage periods can be found in our cookie and privacy settings and in the following sections of this Privacy Policy.

8. Use of Google Applications

This website uses various applications provided by Google Ireland, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Tag Manager

Google Tag Manager is a solution that enables website tags to be managed through a user interface and allows services such as Google Analytics and Google marketing services to be integrated into our online offering. Tag Manager itself does not process users’ personal data.

Google Analytics and Google Signals

Google Analytics uses cookies that are stored on your computer and enable an analysis of your use of the website. The information generated by these cookies, for example about the time, location and frequency of your use of this website, is generally transferred to a Google server in the United States and stored there.

Online identifiers, including cookie identifiers, internet protocol addresses, device identifiers and customer-assigned identifiers are disclosed to Google.

Google Analytics has been extended on this website using the “anonymizeIp” code. This code causes the final eight bits of IP addresses to be deleted, meaning that your IP address is recorded in shortened form, known as IP masking.

As a rule, Google shortens your IP address before it is transferred within Member States of the European Union or other contracting states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the United States and shortened there.

We have also integrated the “Google Signals” extension into our website. This allows Google to compare activities recorded on our website with Google information from the accounts of signed-in Google users, thereby allowing audience measurement and conversions, as described below, to be recorded more accurately.

Google Advertising Network

Google Ads, Campaign Manager and Conversion Measurement

These applications enable us to display advertisements for and within our online offering in a more targeted manner and to present users only with advertisements that potentially correspond to their interests.

For example, where a user is shown advertisements for products in which they have shown an interest on other online offerings, this is referred to as remarketing. This enables us to create user profiles.

For these purposes, when our website or other websites on which the Google advertising network is active are accessed, Google immediately executes code and integrates so-called remarketing tags into the website. These are invisible graphics or code, also referred to as web beacons.

With their assistance, an individual cookie, meaning a small file, is stored on the user’s device. Comparable technologies may also be used instead of cookies.

This file records which websites the user has visited, the content in which the user is interested and the offers on which the user has clicked. It also records technical information about the browser and operating system, referring websites, the time of the visit and other information regarding the use of the online offering.

The information collected using cookies or similar technologies is used by Google to produce conversion statistics for us. For example, we learn the total number of users who clicked on our advertisement and were redirected to a page containing a conversion-tracking tag.

Google also displays our advertisements in a targeted manner to people who have shown an interest in our products or similar products.

We also use the enhanced-conversions feature to record conversions more accurately. For this purpose, where website visitors have consented through the cookie banner, we transmit conversion data and customer data to Google.

The data is transmitted to Google only in hashed form and not as plain text. Google compares the information with existing Google data and profiles. Where you are registered with a Google service, Google may, for example, associate the visit with your account.

Data Transfers to Third Countries

The use of Google involves transferring data to the United States. This may result, among other things, in unauthorised access to your personal data or restrictions on your rights as a data subject.

However, Google LLC is listed under the EU–US Data Privacy Framework, meaning that an adequacy decision of the European Commission currently applies to the data transfer.

Legal Basis and Right of Withdrawal

The legal basis for processing personal data using the Google cookies and tracking technologies described above is your consent pursuant to section 25(1) TDDDG for the placement of cookies on your device and, at the same time, Article 6(1), sentence 1, point (a) GDPR for the processing of data.

You may provide this consent through the cookie banner or the Privacy Settings.

Consent to data processing may be withdrawn at any time without affecting the lawfulness of processing performed on the basis of consent before its withdrawal, for example through the Privacy Settings in the footer of this website.

You may also prevent data processing through the appropriate “Do Not Track” settings in your browser.

You may further prevent Google from collecting the data generated by cookies concerning your use of the websites and from processing this data by downloading and installing the browser plug-in available under “Ad Settings” and “Campaign Manager Opt-Out Extension.”

Further Data Processing by Google

When Google tools are used, it cannot be ruled out that cookies placed by Google may collect personal data in addition to the shortened IP address.

We wish to point out that Google may transfer this information to additional recipients and that such information may be processed on Google’s behalf.

We have no influence over the scope or further use of the data and therefore provide information in accordance with our current level of knowledge.

Through the integration of Campaign Manager, Google receives information that you have accessed the relevant part of our website or clicked on one of our advertisements.

Where you are registered with a Google service, Google may associate the visit with your account. Even where you are not registered with Google or are not signed in, the provider may identify and store your IP address.

Further information about Google’s use of data and the available configuration, storage and deactivation options can be found in Google’s Privacy Policy and in Google’s settings for the display of advertisements:

https://adssettings.google.com/authenticated

9. Use of Meta Applications

Within our online offering, we use the Facebook Pixel provided by the social network Facebook, which is operated by Meta Platforms, Inc. (“Meta”), for the analysis, optimisation and commercial operation of our online offering.

The information generated by the pixel concerning your use of this website is transferred to and stored on a Facebook server in the United States.

The Facebook Pixel allows Facebook to identify visitors to our online offering as a target group for the display of advertisements, known as Facebook Ads.

Accordingly, we use the Facebook Pixel to display the Facebook Ads placed by us only to Facebook users who have shown an interest in our online offering or who exhibit certain characteristics, such as interests in specific topics or products identified from the websites visited, which we transmit to Facebook.

Using the Facebook Pixel, we also wish to ensure that our Facebook Ads correspond to users’ potential interests and are not perceived as intrusive.

The Facebook Pixel also allows us to assess the effectiveness of Facebook advertisements for statistical and market-research purposes by determining whether users were redirected to our website after clicking on a Facebook advertisement, known as a conversion.

Facebook processes the data in accordance with Facebook’s Data Use Policy. General information regarding the display of Facebook Ads is therefore available in Facebook’s Data Use Policy. Specific information and details about the Facebook Pixel and how it works are available in Facebook’s Help Centre.

To configure the types of advertisements displayed to you within Facebook, you may access the page provided by Facebook and follow the instructions concerning settings for usage-based advertising.

The settings apply across platforms, meaning that they are adopted for all devices, such as desktop computers and mobile devices.

Data Transfers to Third Countries

The use of the Facebook Pixel involves transferring data to the United States. This may result, among other things, in unauthorised access to your personal data or restrictions on your rights as a data subject.

However, Meta is listed under the EU–US Data Privacy Framework, meaning that an adequacy decision of the European Commission currently applies to the data transfer.

Legal Basis and Right of Withdrawal

The legal basis is your consent pursuant to section 25(1) TDDDG for placing the cookie on your device and, at the same time, Article 6(1), sentence 1, point (a) GDPR for the processing of data, where you have given your consent through our banner.

Your consent is voluntary and may be withdrawn at any time. To withdraw your consent or change your preferences, please click “Privacy Settings” in the footer of this website.

10. Use of TikTok Applications

Within our online offering, we use advertising applications provided by TikTok Information Technologies UK Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”).

We have integrated the TikTok Pixel into our website and use TikTok Event APIs. The information generated concerning your use of this website is transmitted to a TikTok server.

The data allows TikTok to identify visitors to our online offering as a target group for the display of advertisements, known as TikTok Ads.

Accordingly, we use the pixel to display the advertisements placed by us on TikTok only to users who have shown an interest in our online offering or who exhibit certain characteristics, such as interests in particular topics or products identified from the websites visited, which we transmit to TikTok.

Using the data, we also wish to ensure that our TikTok Ads correspond to users’ potential interests and are not perceived as intrusive.

The data further allows us to assess the effectiveness of advertisements for statistical and market-research purposes by determining whether users were redirected to our website after clicking on a TikTok advertisement, known as conversions.

TikTok processes the data in accordance with TikTok’s Privacy Policy, which contains further information regarding data processing by TikTok.

Data Transfers to Third Countries

The use of TikTok applications may result in further data transfers by the Irish TikTok company, including to third countries outside the EU or EEA.

This may result, among other things, in unauthorised access to your personal data or restrictions on your rights as a data subject. Further information can be found in TikTok’s Privacy Policy linked above.

Legal Basis and Right of Withdrawal

The legal basis is your consent pursuant to section 25(1) TDDDG for placing the cookie on your device and, at the same time, Article 6(1), sentence 1, point (a) GDPR for processing the data, where you have given your consent through our banner.

Your consent is voluntary and may be withdrawn at any time. To withdraw your consent or change your preferences, please click “Privacy Settings” in the footer of this website.

11. Other Tracking Applications

With your consent, we also use cookies and tracking technologies for analysis and advertising purposes, particularly those provided by Hotjar Ltd., Netlify Inc., Tidio Ltd., Klaviyo Inc. and Pinterest Inc.

In particular, this results in data transfers to the United States and China.

These countries have a lower level of data protection than the EU, meaning that we cannot rule out unauthorised access to your data or restrictions on your data-protection rights.

Please take this into account when providing your consent through the cookie banner.

12. Embedded Videos

On our website, you may watch videos embedded from YouTube, a product of Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland.

For this purpose, we have activated YouTube’s enhanced privacy mode, meaning that YouTube collects data from you only where you click on the relevant video.

We also use the video service provided by Vimeo LLC, New York, United States (“Vimeo”). Data is transferred to Vimeo only where you have consented to the placement of cookies through the cookie banner.

By clicking on the videos or providing your consent through the cookie banner, you consent to the processing of data collected about you by YouTube, including by Google LLC in the United States.

This constitutes consent pursuant to section 25(1) TDDDG for placing a cookie on your device, consent to data processing pursuant to Article 6(1), sentence 1, point (a) GDPR and consent to transferring data to a third country without an adequate level of data protection pursuant to Article 49(1), sentence 1, point (a) GDPR.

You may withdraw your consent at any time. Until it is withdrawn, the data processing based on that consent remains lawful.

The applicable terms of use and information regarding storage periods can be found here.

13. Map Services

We embed map services on our websites that are not stored on our servers. These include Google Maps, the map service provided by Google LLC.

To ensure that accessing our websites with embedded map services does not automatically cause third-party content to be loaded, we initially display only maps stored locally.

The third-party provider therefore receives no information at this stage. Third-party content is loaded only after you click on the map.

The third-party provider then receives information that you accessed our website and receives the usage data technically required in this context. We have no influence over the third party’s subsequent processing of the data.

By clicking on the preview image, you give us your consent pursuant to Article 6(1), point (a) GDPR to load the third-party content and thereby transmit the usage data described above to the third-party provider.

Where you do not wish such content to be loaded on other pages, please do not click on the preview images.

Please note that the integration of some map services causes your data to be processed outside the EU or EEA.

In the case of Google Maps, this may result in a data transfer to the United States.

In certain countries, including the United States, there is a risk that authorities may access the data for security and surveillance purposes without informing you or allowing you to seek legal remedies.

Where we use providers in unsafe third countries and you provide your consent, the transfer to an unsafe third country is based on your consent pursuant to Article 49(1), point (a) GDPR.

An adequacy decision of the European Commission under the EU–US Data Privacy Framework also applies to Google LLC.

14. Product Reviews and Surveys

Users have the option of reviewing our products on the website. For attribution purposes, users are required to provide a name or nickname.

We process this data solely to display the review on the website.

Users may also voluntarily participate in surveys. Typeform is used for this purpose.

Where personal data is processed in this context, the legal basis is your consent pursuant to Article 6(1), sentence 1, point (a) GDPR.

You may withdraw your consent at any time. Until it is withdrawn, the data processing based on that consent remains lawful.

15. Use of Trusted Shops

Services and products provided by Trusted Shops SE (“Trusted Shops”), including the Trustbadge, are integrated into our website to display product reviews and offer buyer protection.

For technical reasons, your IP address must be processed for this purpose. This processing is based on Article 6(1), point (f) GDPR.

Our legitimate interest is to be able to advertise using the reviews displayed on our website.

Through the integration, Trusted Shops obtains access to your IP address.

The Trustbadge is also provided through a US-based Content Delivery Network provider commissioned by Trusted Shops.

Further information about data protection at Trusted Shops can be found in its Privacy Policy.

We and Trusted Shops are jointly responsible for the data processing pursuant to Article 26 GDPR.

For questions concerning Trusted Shops and the exercise of your data-protection rights, please contact Trusted Shops in the first instance.

You may, of course, also contact us, and we will forward your enquiry to Trusted Shops where this is required in order to respond to it.

16. Competitions and Promotions

From time to time, we offer participation in competitions or other promotions.

Unless otherwise stated in specific privacy notices for the relevant competition or promotion, personal data provided to us as part of participation in the competition or promotion is used exclusively to conduct the competition or promotion.

This may include selecting the winner, notifying the winner and sending the prize.

The legal basis for data processing in connection with competitions and promotions is Article 6(1), sentence 1, point (b) GDPR.

Where you provide a declaration of consent as part of the competition or another promotion, your data will also be processed for the purposes specified in the relevant declaration of consent.

In this case, the legal basis for processing is Article 6(1), sentence 1, point (a) GDPR.

You may withdraw your consent at any time with effect for the future without suffering any disadvantages.

For this purpose, it is sufficient to notify the contact point specified in the declaration of consent.

Until consent is withdrawn, the data processing performed on the basis of that consent remains lawful.

After the competition or promotion has ended, participants’ data is generally deleted.

Where physical prizes are awarded, winners’ data is retained for the duration of the statutory warranty claims so that, where a prize is defective, repair or replacement may be arranged where necessary.

The legal basis for this processing is Article 6(1), sentence 1, point (f) GDPR.

Winners’ data is also stored for the duration of statutory retention periods pursuant to Article 6(1), point (c) GDPR in conjunction with sections 147 of the German Fiscal Code and 257 of the German Commercial Code.

Further details can be found in any more specific privacy notices applying to the relevant competition or promotion. Such specific notices take precedence over the information provided above.

17. Refer-a-Friend Program

We offer our existing customers the opportunity to participate in our refer-a-friend program.

You may register on the relevant landing page and, after registration is complete, receive a link to share with your friends and acquaintances.

They may register with us through this link and receive a discount on their first order.

You will also receive a discount on your next order, as the link allows us to recognise that the referral was made by you.

We record that you participated in the refer-a-friend program and add this information to your customer account.

Your personal data is processed for administering and handling the referral on the basis of Article 6(1), point (f) GDPR.

Our legitimate interest is to administer the referral program properly and grant the discounts.

Where the data processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, the legal basis for the processing is also Article 6(1), point (b) GDPR.

18. Applicant Portal

We use the applicant portal provided by JOIN Solutions GmbH (“join”) to process applications.

We process your personal data for the purpose of deciding whether to establish an employment relationship with you.

As part of the application procedure, we process the personal data collected through join, particularly your contact details, such as your name and address, and all data relating to the application, such as your CV, certificates and qualifications.

Where you apply for reimbursement of travel expenses, we also require your bank details.

The legal basis for processing your data is Article 88 GDPR in conjunction with section 26(1), sentence 1 of the German Federal Data Protection Act, or Article 6(1), sentence 1, point (b) GDPR.

We also collect and process personal data that you provide to us voluntarily.

Fields identified as voluntary or optional do not have to be completed.

This data is processed on the basis of your revocable consent pursuant to Articles 6(1), point (a) and 7 GDPR in conjunction with section 26(2) of the German Federal Data Protection Act.

Where you are not hired but your application remains of interest to us, we may ask whether we may retain your application for future vacancies.

This extended retention is based on your revocable consent pursuant to Articles 6(1), point (a) and 7 GDPR in conjunction with section 26(2) of the German Federal Data Protection Act.

This consent is voluntary. A refusal to provide it has no effect on other ongoing application procedures.

Data Recipients

We treat your data confidentially and do not disclose it to third parties.

Where applicable, we use service providers that are strictly bound by our instructions and support us in areas such as IT or the archiving and destruction of documents.

Separate data-processing agreements have been concluded with these providers. This includes join in particular as the provider of the applicant portal.

Storage Period

Where no statutory retention period applies, the data is deleted as soon as storage is no longer required or our legitimate interest in storing it has ceased to exist.

Where no employment takes place, this is generally no later than six months after the application procedure has been completed or after the rejection has been received.

We also delete data where you withdraw your consent to the processing of your data.

We retain your declaration of consent to the extended storage of your applicant data for a further three years in order to comply with our accountability obligations within the meaning of Article 5(2) GDPR.

In individual cases, particular data may be stored for longer periods, for example in relation to the reimbursement of travel expenses.

The duration of storage is then determined by applicable statutory retention obligations, such as those arising under the German Fiscal Code, which provides for six years, or the German Commercial Code, which provides for ten years.

Your data may also be stored for longer where, following a balancing of interests, further processing is required for the establishment, exercise or defence of legal claims.

19. Links to Other Websites or Apps

Where our website contains links to other websites or offers apps for download, this Privacy Policy does not apply to those external websites or apps.

Please review the applicable privacy provisions on the relevant external websites or apps.

20. Privacy Policy for Our Social-Media Pages

When you visit our social-media pages, it may be necessary to process data relating to you.

We therefore wish to inform you below about how your data is handled and about the rights available to you.

Responsibility

In addition to us, the respective operator of the social-media platform is also responsible for processing your personal data.

Where we can influence or configure the data processing, we seek, within the options available to us, to encourage the operator of the social-media platform to handle data in compliance with data-protection requirements.

Please also review the Privacy Policy of the relevant social-media platform in this context.

Data Processing by Us

Data that you enter on our social-media pages, such as usernames, comments, videos, images, likes and public messages, is published by the social-media platform.

We do not process this data for any purposes other than publication and communication.

We merely reserve the right to delete content where this is necessary.

Where the relevant function is available on the social-media platform, we may share your content on our page and communicate with you through the social-media platform.

The legal basis for processing your data is Article 6(1), sentence 1, point (f) GDPR.

The data processing is performed on the basis of our legitimate interest in carrying out public-relations activities for our company and communicating with you.

The operator of the social-media platform may access your data. Apart from this, we do not disclose your data to other parties unless this is permitted by law or with your consent.

Use of our social-media presences is voluntary and personal data is provided through voluntary interaction.

Where you submit an enquiry to us through the social-media platform, we may, depending on the content, refer you to other secure communication channels that guarantee confidentiality.

For example, you may send your enquiries at any time to the postal or email address stated in our Legal Notice.

You are responsible for choosing the appropriate communication channel.

We delete your personal data when it is no longer required, unless statutory retention obligations apply.

The data is deleted after any statutory retention obligations have expired.

Some social-media platforms produce statistics based on usage data that contain information regarding your interaction with our social-media page.

We cannot influence or prevent the production and provision of these statistics.

We process this information pursuant to Article 6(1), sentence 1, point (f) GDPR on the basis of our legitimate interest in evaluating the use of our social-media pages and improving our content for the relevant target audience.

We use Facebook Ads, including in relation to Instagram, to provide and personalise advertising.

This is based on:

• demographic data;
• user behaviour, based on conduct and interests derived from viewed content, communications and other information provided by the user;
• networks and connections;
• device information, including operating system and device type; and
• location-specific targeting.

For this purpose, we use target-group definitions provided to us by the social-media provider.

We use only anonymous target-group definitions. This means that we define characteristics based, for example, on general demographic information, behaviour, interests and connections.

The operator of the social-media platform uses these definitions to display corresponding advertisements to its users.

The legal basis is consent pursuant to Article 6(1), sentence 1, point (a) GDPR, which the operator of the social-media platform has obtained from its users.

To withdraw this consent, please use the withdrawal options provided by the social-media platform, as the operator of the social-media platform is responsible for this processing.

We do not use target-group definitions based on location data.

We do not disclose personal data to the operator of the social-media platform as part of the target-group definition.

We occasionally also use information concerning visits to or interactions with other pages for target-group definition, known as remarketing.

For this purpose, we also use cookies, among other technologies.

In these cases, however, we first obtain users’ consent through a consent banner on the relevant other pages and provide information there concerning the data processing.

You may withdraw this consent at any time by reopening the consent banner on the relevant website.

Until consent is withdrawn, the data processing performed on the basis of that consent remains lawful.

You consent to personalised advertising through the terms of use of the social networks pursuant to Article 6(1), sentence 1, point (a) GDPR.

This data processing can be prevented through the social-network settings by withdrawing consent. Consent may be withdrawn at any time.

The data processing performed on the basis of consent before its withdrawal remains lawful.

Where you have specified in the settings that personalised advertising should not be displayed, your data will not be used for personalised advertising.

We ourselves cannot associate this data with a specific person or profile at any time.

To manage our social-media pages, produce statistical analyses and communicate with our users, we use an application provided by Swat.io GmbH (“swat.io”), link: https://swat.io/en/

In this context, swat.io may obtain access to your data where you interact with our social-media pages or send us messages through social media.

As a processor, swat.io is contractually obliged to comply with data-protection requirements and confidentiality obligations.

Data Processing by the Operator of the Social-Media Platform

The operator of the social-media platform uses web-tracking methods.

Web tracking may take place regardless of whether you are signed in to or registered with the social-media platform.

We therefore wish to point out that it cannot be ruled out that the provider of the social-media platform may use your profile and behavioural data to analyse matters such as your habits, personal relationships and preferences.

We have no influence over the provider’s processing of your data in this respect. Use of the social-media platform therefore takes place at your own risk.

The operator of the social-media platform may process your personal data outside the EU or EEA, as the parent companies are based in the United States and transfers from the European entities to the US entities cannot be ruled out.

There is therefore a risk that authorities may access the data for security and surveillance purposes without informing you or allowing you to seek legal remedies.

The legal basis for placing a cookie on your device is your consent pursuant to section 25(1) TDDDG, which you may provide on the social-media platform.

Where you use the social-media platform through our social-media presences, the transfer of personal data through use of the social-media platform is performed on the basis of your consent pursuant to Article 6(1), sentence 1, point (a) GDPR.

The transfer of data to a third country without an adequate level of data protection is also based on your consent pursuant to Article 49(1), sentence 1, point (a) GDPR.

Where you no longer access our page, no further data transfer takes place.

Consent may be withdrawn at any time. The data processing performed on the basis of consent before its withdrawal remains lawful.

Further information concerning data processing by the operator of the social-media platform, configuration options for protecting your privacy, additional objection options and, where available and concluded, the agreement pursuant to Article 26 GDPR can be found in the provider’s Privacy Policy, on its other pages and in your profile settings:

Facebook: https://www.facebook.com/privacy/explanation

Instagram: https://help.instagram.com/519522125107875

YouTube: https://policies.google.com/privacy?hl=de&gl=de

TikTok: https://www.tiktok.com/legal/page/eea/new-privacy-policy/de-DE

Pinterest: https://policy.pinterest.com/de/privacy-policy

Your Rights as a User

As a website user, you may assert the rights described in the section entitled “Your Rights” against both us and the operator of the social-media platform, provided the relevant requirements are met.

Where you wish to object to a specific data-processing activity over which we have influence, please use the contact details stated in the Legal Notice.

21. Data Recipients and Transfers to Third Countries

In addition to the above, we use various third-party providers to provide different services, particularly in the areas of IT, hosting and support.

As part of providing their services, these third parties may obtain access to your personal data.

Such access may also take place from third countries outside the EU or EEA in which the level of data protection may be lower than in the EU.

This may result in unauthorised access to your data or restrictions on your data-protection rights.

Where the European Commission has not adopted an adequacy decision for the relevant third country, we agree the European Commission’s Standard Contractual Clauses with the providers and conduct Transfer Impact Assessments.

These clauses contractually oblige the providers to comply with European data-protection requirements.

Further information can be obtained upon request from our support team.

The Standard Contractual Clauses can be accessed through the following link
https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=de

22. Deletion Periods

The personal data of visitors to our website is deleted when knowledge of that data is no longer required for the purposes described above, unless statutory provisions require longer storage or a different period is specified in the preceding sections.

After consent has been withdrawn, the personal data underlying that consent is stored for three years from the date of withdrawal on the basis of our legitimate interests pursuant to Article 6(1), sentence 1, point (f) GDPR.

This is done to provide evidence that consent was lawfully obtained, pursuant to Articles 5(2) and 83(8) GDPR in conjunction with section 41, sentence 2 of the German Federal Data Protection Act and section 31(2), no. 1 of the German Administrative Offences Act.

However, this does not apply to cookies where they have been deleted.

23. Your Rights

Where you have questions or comments concerning the privacy settings, please contact us using the contact details stated above or in the Legal Notice.

When your personal data is processed, the GDPR grants you certain rights as a data subject.

Right of Access

Article 15 GDPR

You have the right to request confirmation as to whether personal data concerning you is being processed.

Where this is the case, you have the right to access that personal data and the information specified in Article 15 GDPR.

Right to Rectification

Article 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you without undue delay and, where applicable, the completion of incomplete data.

Right to Erasure

Article 17 GDPR

You have the right to request that personal data concerning you be deleted without undue delay where one of the grounds specified in Article 17 GDPR applies.

Right to Restriction of Processing

Article 18 GDPR

You have the right to request restriction of processing where one of the conditions specified in Article 18 GDPR is met.

Right to Data Portability

Article 20 GDPR

In certain cases specified in Article 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request the transfer of that data to a third party.

Right to Lodge a Complaint with a Supervisory Authority

Article 77 GDPR

Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority where you believe that the processing of personal data concerning you infringes data-protection provisions.

The right to lodge a complaint may be exercised in particular before a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

Your Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data.

Where you object, we will no longer process your personal data.

This does not apply where we can demonstrate compelling legitimate grounds, such as legal requirements, for the processing.

The objection may be submitted in any form with the subject line “Objection” and should be sent to the address stated in the introduction or the Legal Notice.